Skip to main content

Overview

The WLKOM C2 (Command & Control) is a web-based interface that allows an attacker to authenticate to and control a machine infected with the epirootkit module. It acts as the bridge between the attacker's browser and the kernel module running on the target.

Architecture​

The C2 server is a single Node.js process that runs three services simultaneously:

Attacker's Browser            C2 Server (Node.js)              Infected Machine
┌──────────────┐            ┌─────────────────────┐           ┌──────────────┐
│              │  WebSocket │                     │    TCP    │              │
│   Web UI     ├───────────►  HTTP + WS Server    │◄──────────┤  Kernel      │
│  (HTML/JS)   │◄───────────┤  (port 8080)        │───────────►  Module      │
│              │            │                     │           │              │
└──────────────┘            │  TCP Server         │           └──────────────┘
                            │  (port 4242)        │
                            └─────────────────────┘
ServicePortProtocolPurpose
TCP Server4242TCPListens for the rootkit's incoming connection
HTTP Server8080HTTPServes the static Web UI files
WebSocket Server8080WebSocketReal-time bridge between browser and rootkit

Communication Flow​

  1. The rootkit (on the infected machine) connects outbound to the C2 server on port 4242.
  2. The attacker opens http://<c2-server>:8080 in a browser.
  3. The browser connects via WebSocket to the same HTTP server.
  4. All messages between the browser and rootkit are relayed through the C2 server.

All traffic between the C2 server and the rootkit is obfuscated with ROT64 encryption. The WebSocket traffic between the browser and C2 server uses plain JSON.

For a full protocol reference (TCP message formats and WebSocket JSON schema), see the API reference: ../api/attacker-ui-protocol

Prerequisites​

  • Node.js >= 18.0.0
  • The ws package (installed via npm install)

Quick Start​

From the attacker-ui directory:

npm install
npm start

The server starts and outputs:

[+] TCP listener (rootkit)  → 0.0.0.0:4242
[+] Web UI                  → http://0.0.0.0:8080
[~] Open http://localhost:8080 in your browser

For development with auto-reload:

npm run dev